noresponse 2.0.19 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b943969974c1baa6424c9a385a9197719df01f57f2b901df3737e601ccd85bd8
-  data.tar.gz: 5c6e129ac29f9ab0a2bdd3a6ec3bd19b2e25c67973f60ead05f30a1c15e2a463
+  metadata.gz: f7f2f99e8a5df281a10706ca39f72c60dd4e0c945f6a895e95644921ef902125
+  data.tar.gz: 5c9a7bcdd021bbec006baa70a1e70c30e27845fbb0f3244e9657aefa22deb8bf
 SHA512:
-  metadata.gz: 9271c0b0010bd1c14933def2ba875a5f9f033ddfca6daa77f6699157d6ca881668f5a79ed2798780eedea552837d717ea8d8f7b87b246f62d7e57e4992e9a5ea
-  data.tar.gz: dbc5b7a75472be7c169fbdca7d3b17fbcbfbbc8e926a3b25800e61c757e8d0d5a245c62dc7c71528ba0f164f15adbd9d1041a8b829ba6d524a06eb6f91966b33
+  metadata.gz: bc80309fad1e4e052a6fdb5bd3a9df90c3d9aab591a940b344678fa6ab9c7026c9f528b100a6ab0c68c1ed5b6ad824164600576702106a6e422d9f77eecdc8f4
+  data.tar.gz: 60e634af7afff07030476d5697bafecea730ef81062cdaad669f73c742b82f39b30f446fb094ee2ae9fbf02923703daf3baad858868f61844654a32cc69c69a7

data/lib/no_response/integrations.rb

@@ -706,7 +706,7 @@ module NoResponse
           response: http_response
         )
         return Models::Operations::DeleteIntegrationResponse.new(
-          headers: {}
+          headers: http_response.headers
         )
       elsif Utils.match_status_code(http_response.status, ["400"])
         if Utils.match_content_type(content_type, "application/problem+json")

data/lib/no_response/late_results.rb

@@ -11,7 +11,9 @@
 # user.
 #
 # The handler verifies the delivery itself, so it never acts on an unverified
-# event. The provider calls are thin: you pass the credentials, and each
+# event, and it never acts on a test event from the send-test-event call. Every
+# provider call treats a 404 (user or session already gone) as done, so a
+# repeated delivery is safe. The provider calls are thin: you pass the credentials, and each
 # action is the provider's documented admin endpoint.
 
 require 'erb'
@@ -54,12 +56,12 @@ module NoResponse
 
     class << self
       # The action your policy names for a verified event. Only a served
-      # assessment with a recommendation can act. policy maps allow, step_up
-      # and review (as strings or symbols) to NONE, REVOKE_SESSIONS or BAN; a
-      # recommendation you leave out does nothing. An unknown action raises
-      # ArgumentError.
+      # assessment with a recommendation can act; a test event never does.
+      # policy maps allow, step_up and review (as strings or symbols) to NONE,
+      # REVOKE_SESSIONS or BAN; a recommendation you leave out does nothing. An
+      # unknown action raises ArgumentError.
       def action_for(event, policy = DEFAULT_POLICY)
-        return NONE if event.type != 'assessment.updated' || event.expired?
+        return NONE if event.type != 'assessment.updated' || event.test? || event.expired?
 
         data = event.data
         recommendation = data.recommendation || data.risk&.recommendation
@@ -111,7 +113,8 @@ module NoResponse
       # Clerk Backend API. revoke_sessions lists the user's active sessions
       # (GET /sessions?user_id&status=active) and revokes each
       # (POST /sessions/{id}/revoke). ban is POST /users/{id}/ban, which
-      # revokes every session and blocks sign-in.
+      # revokes every session and blocks sign-in. A 404 on any call (user or
+      # session already gone) counts as done, so a repeated delivery is safe.
       #
       # base_url defaults to https://api.clerk.com/v1. http_client is an
       # optional callable (method, uri, headers, body) returning
@@ -126,7 +129,9 @@ module NoResponse
       # GET /user_management/users/{id}/sessions and revokes each active one
       # with POST /user_management/sessions/revoke. WorkOS has no block or ban,
       # so ban revokes the sessions and then deletes the user
-      # (DELETE /user_management/users/{id}); deletion is permanent.
+      # (DELETE /user_management/users/{id}); deletion is permanent. A 404 on
+      # any call (user or session already gone) counts as done, so a repeated
+      # delivery is safe.
       #
       # base_url defaults to https://api.workos.com.
       def workos(api_key:, base_url: 'https://api.workos.com', http_client: nil)
@@ -141,7 +146,8 @@ module NoResponse
       # (PATCH /users/{id}), then does the same. Pass domain (such as
       # example.eu.auth0.com; the API is https://{domain}/api/v2) or base_url.
       # token is a Management API access token with update:users,
-      # delete:sessions and delete:refresh_tokens.
+      # delete:sessions and delete:refresh_tokens. A 404 on any call (user
+      # already gone) counts as done, so a repeated delivery is safe.
       def auth0(token:, domain: nil, base_url: nil, http_client: nil)
         raise ArgumentError, 'auth0 needs token' if token.to_s.empty?
 
@@ -232,16 +238,16 @@ module NoResponse
         (0...1000).each do |round|
           page = Segment.sessions(@call.call('GET', '/sessions', query: [['user_id', user_id], %w[status active],
                                                                          ['limit', PAGE.to_s],
-                                                                         ['offset', (round * PAGE).to_s]]))
+                                                                         ['offset', (round * PAGE).to_s]], allow_404: true))
           active.concat(Segment.active_ids(page))
           break if page.length < PAGE
         end
-        active.each { |id| @call.call('POST', "/sessions/#{ERB::Util.url_encode(id)}/revoke") }
+        active.each { |id| @call.call('POST', "/sessions/#{ERB::Util.url_encode(id)}/revoke", allow_404: true) }
         nil
       end
 
       def ban(user_id)
-        @call.call('POST', "/users/#{Segment.encode(user_id)}/ban")
+        @call.call('POST', "/users/#{Segment.encode(user_id)}/ban", allow_404: true)
         nil
       end
     end
@@ -260,14 +266,14 @@ module NoResponse
         1000.times do
           query = T.let([%w[limit 100]], T::Array[T::Array[String]])
           query << ['after', after] if after
-          body = @call.call('GET', "/user_management/users/#{user}/sessions", query: query)
+          body = @call.call('GET', "/user_management/users/#{user}/sessions", query: query, allow_404: true)
           active.concat(Segment.active_ids(Segment.sessions(body)))
           nxt = body.is_a?(Hash) && body['list_metadata'].is_a?(Hash) ? body['list_metadata']['after'] : nil
           break unless nxt.is_a?(String) && !nxt.empty?
 
           after = nxt
         end
-        active.each { |id| @call.call('POST', '/user_management/sessions/revoke', body: { 'session_id' => id }) }
+        active.each { |id| @call.call('POST', '/user_management/sessions/revoke', body: { 'session_id' => id }, allow_404: true) }
         nil
       end
 
@@ -287,13 +293,13 @@ module NoResponse
 
       def revoke_sessions(user_id)
         user = Segment.encode(user_id)
-        @call.call('DELETE', "/users/#{user}/sessions")
-        @call.call('DELETE', "/users/#{user}/refresh-tokens")
+        @call.call('DELETE', "/users/#{user}/sessions", allow_404: true)
+        @call.call('DELETE', "/users/#{user}/refresh-tokens", allow_404: true)
         nil
       end
 
       def ban(user_id)
-        @call.call('PATCH', "/users/#{Segment.encode(user_id)}", body: { 'blocked' => true })
+        @call.call('PATCH', "/users/#{Segment.encode(user_id)}", body: { 'blocked' => true }, allow_404: true)
         revoke_sessions(user_id)
       end
     end

data/lib/no_response/models/shared/assessment.rb

@@ -134,6 +134,12 @@ module NoResponse
           Crystalline::Nilable.new(::String),
           {'format_json': {'letter_case': ::NoResponse::Utils.field_name("assessment_url")}}
         )
+        # The identity fields of the auth context the assessment was made with, echoed for the tenant's own correlation: the request's auth_context, or the one a hosted provider hook (POST /hooks/{integration_id}) built, with transport provider_hook and its hook_point. Present exactly when the request carried an auth_context, and the same on every revision of the assessment. Values are as the request or the hook sent them; tokens, timestamps, roles and scopes are not echoed, and the echo does not change the score.
+        field(
+          :auth_context,
+          Crystalline::Nilable.new(Models::Shared::AssessmentAuthContext),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("auth_context")}}
+        )
 
         sig {
           params(
@@ -154,7 +160,8 @@ module NoResponse
             risk: T.nilable(Models::Shared::Risk),
             signals: T.nilable(T::Array[Models::Shared::Signal]),
             policy_basis: ::String,
-            assessment_url: T.nilable(::String)
+            assessment_url: T.nilable(::String),
+            auth_context: T.nilable(Models::Shared::AssessmentAuthContext)
           )
             .void
         }
@@ -176,7 +183,8 @@ module NoResponse
           risk: nil,
           signals: nil,
           policy_basis: "heuristic_unvalidated",
-          assessment_url: nil
+          assessment_url: nil,
+          auth_context: nil
         )
           @assessment_id = assessment_id
           @account_id = account_id
@@ -204,6 +212,7 @@ module NoResponse
 
           @policy_basis = "heuristic_unvalidated"
           @assessment_url = assessment_url
+          @auth_context = auth_context
         end
 
         sig { params(other: T.untyped).returns(T::Boolean) }
@@ -227,6 +236,7 @@ module NoResponse
           return false unless @signals == other.signals
           return false unless @policy_basis == other.policy_basis
           return false unless @assessment_url == other.assessment_url
+          return false unless @auth_context == other.auth_context
           true
         end
       end

data/lib/no_response/models/shared/assessment.rbi

@@ -113,4 +113,10 @@ class NoResponse::Models::Shared::Assessment
 
   def assessment_url=(str_)
   end
+
+  def auth_context
+  end
+
+  def auth_context=(str_)
+  end
 end

data/lib/no_response/models/shared/assessmentauthcontext.rb

@@ -0,0 +1,121 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # The identity fields of the auth context the assessment was made with, echoed for the tenant's own correlation: the request's auth_context, or the one a hosted provider hook (POST /hooks/{integration_id}) built, with transport provider_hook and its hook_point. Present exactly when the request carried an auth_context, and the same on every revision of the assessment. Values are as the request or the hook sent them; tokens, timestamps, roles and scopes are not echoed, and the echo does not change the score.
+      class AssessmentAuthContext
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # The provider slug the context named.
+        field(
+          :provider,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("provider"), required: true}}
+        )
+        # The issuer the context named.
+        field(
+          :issuer,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("issuer"), required: true}}
+        )
+        # The verified flag the context carried. A provider_hook context is always false.
+        field(
+          :verified,
+          Crystalline::Boolean.new,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("verified"), required: true}}
+        )
+        # Where the context was derived: backend (also when the request named no transport), browser, or provider_hook for a hosted provider hook.
+        field(
+          :transport,
+          Models::Shared::Transport,
+          {
+            'format_json': {
+              'letter_case': ::NoResponse::Utils.field_name("transport"),
+              required: true,
+              'decoder': ::NoResponse::Utils.open_enum_from_string(Models::Shared::Transport, false)
+            }
+          }
+        )
+        # The subject the context named; absent when it named none (a pre_registration hook).
+        field(
+          :subject,
+          Crystalline::Nilable.new(::String),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("subject")}}
+        )
+        # The session identifier the context named, when it named one.
+        field(
+          :session_id,
+          Crystalline::Nilable.new(::String),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("session_id")}}
+        )
+        # The organization identifier the context named, when it named one.
+        field(
+          :organization_id,
+          Crystalline::Nilable.new(::String),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("organization_id")}}
+        )
+        # The provider event a provider_hook context was sent for; absent for any other transport.
+        field(
+          :hook_point,
+          Crystalline::Nilable.new(Models::Shared::HookPoint),
+          {
+            'format_json': {
+              'letter_case': ::NoResponse::Utils.field_name("hook_point"),
+              'decoder': ::NoResponse::Utils.open_enum_from_string(Models::Shared::HookPoint, true)
+            }
+          }
+        )
+
+        sig {
+          params(
+            provider: ::String,
+            issuer: ::String,
+            verified: T::Boolean,
+            transport: Models::Shared::Transport,
+            subject: T.nilable(::String),
+            session_id: T.nilable(::String),
+            organization_id: T.nilable(::String),
+            hook_point: T.nilable(Models::Shared::HookPoint)
+          )
+            .void
+        }
+        def initialize(
+          provider:,
+          issuer:,
+          verified:,
+          transport:,
+          subject: nil,
+          session_id: nil,
+          organization_id: nil,
+          hook_point: nil
+        )
+          @provider = provider
+          @issuer = issuer
+          @verified = verified
+          @transport = transport
+          @subject = subject
+          @session_id = session_id
+          @organization_id = organization_id
+          @hook_point = hook_point
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @provider == other.provider
+          return false unless @issuer == other.issuer
+          return false unless @verified == other.verified
+          return false unless @transport == other.transport
+          return false unless @subject == other.subject
+          return false unless @session_id == other.session_id
+          return false unless @organization_id == other.organization_id
+          return false unless @hook_point == other.hook_point
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/assessmentauthcontext.rbi

@@ -0,0 +1,56 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::AssessmentAuthContext
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::AssessmentAuthContext
+  def provider
+  end
+
+  def provider=(str_)
+  end
+
+  def issuer
+  end
+
+  def issuer=(str_)
+  end
+
+  def verified
+  end
+
+  def verified=(str_)
+  end
+
+  def transport
+  end
+
+  def transport=(str_)
+  end
+
+  def subject
+  end
+
+  def subject=(str_)
+  end
+
+  def session_id
+  end
+
+  def session_id=(str_)
+  end
+
+  def organization_id
+  end
+
+  def organization_id=(str_)
+  end
+
+  def hook_point
+  end
+
+  def hook_point=(str_)
+  end
+end

data/lib/no_response/models/shared/authcontext.rb

@@ -128,25 +128,25 @@ module NoResponse
           Crystalline::Nilable.new(Crystalline::Boolean.new),
           {'format_json': {'letter_case': ::NoResponse::Utils.field_name("impersonated")}}
         )
-        # Where this context was derived. Backend is the trusted integration path; browser values are treated as weak hints. provider_hook is a hosted provider hook (an Auth0 or WorkOS Action) calling at hook_point; it needs hook_point and verified false, and its authentication facts are not scored.
+        # Where the context was derived: backend (also when the request named no transport), browser, or provider_hook for a hosted provider hook.
         field(
           :transport,
           Crystalline::Nilable.new(Models::Shared::Transport),
           {
             'format_json': {
               'letter_case': ::NoResponse::Utils.field_name("transport"),
-              'decoder': ::NoResponse::Utils.enum_from_string(Models::Shared::Transport, true)
+              'decoder': ::NoResponse::Utils.open_enum_from_string(Models::Shared::Transport, true)
             }
           }
         )
-        # The provider event a provider_hook context was sent for. pre_registration runs before the user exists, so subject and the request's account_id may be absent there. Sent only with transport provider_hook.
+        # The provider event a provider_hook context was sent for; absent for any other transport.
         field(
           :hook_point,
           Crystalline::Nilable.new(Models::Shared::HookPoint),
           {
             'format_json': {
               'letter_case': ::NoResponse::Utils.field_name("hook_point"),
-              'decoder': ::NoResponse::Utils.enum_from_string(Models::Shared::HookPoint, true)
+              'decoder': ::NoResponse::Utils.open_enum_from_string(Models::Shared::HookPoint, true)
             }
           }
         )

data/lib/no_response/models/shared/hookpoint.rb

@@ -4,8 +4,9 @@
 module NoResponse
   module Models
     module Shared
-      # HookPoint - The provider event a provider_hook context was sent for. pre_registration runs before the user exists, so subject and the request's account_id may be absent there. Sent only with transport provider_hook.
-      class HookPoint < T::Enum
+      # HookPoint - The provider event a provider_hook context was sent for; absent for any other transport.
+      class HookPoint
+        include ::Crystalline::Enum
         enums do
           PRE_REGISTRATION = new("pre_registration")
           POST_REGISTRATION = new("post_registration")
@@ -13,6 +14,8 @@ module NoResponse
           POST_LOGIN = new("post_login")
           TOKEN_ISSUANCE = new("token_issuance")
         end
+
+        open!
       end
     end
   end

data/lib/no_response/models/shared/security.rb

@@ -11,12 +11,12 @@ module NoResponse
 
         field(
           :api_key,
-          ::String,
+          Crystalline::Nilable.new(::String),
           {'security': {'scheme': true, 'type': "http", 'sub_type': "bearer", 'field_name': "Authorization"}}
         )
 
-        sig { params(api_key: ::String).void }
-        def initialize(api_key:)
+        sig { params(api_key: T.nilable(::String)).void }
+        def initialize(api_key: nil)
           @api_key = api_key
         end
 

data/lib/no_response/models/shared/transport.rb

@@ -4,13 +4,16 @@
 module NoResponse
   module Models
     module Shared
-      # Transport - Where this context was derived. Backend is the trusted integration path; browser values are treated as weak hints. provider_hook is a hosted provider hook (an Auth0 or WorkOS Action) calling at hook_point; it needs hook_point and verified false, and its authentication facts are not scored.
-      class Transport < T::Enum
+      # Transport - Where the context was derived: backend (also when the request named no transport), browser, or provider_hook for a hosted provider hook.
+      class Transport
+        include ::Crystalline::Enum
         enums do
           BACKEND = new("backend")
           BROWSER = new("browser")
           PROVIDER_HOOK = new("provider_hook")
         end
+
+        open!
       end
     end
   end

data/lib/no_response/models/shared.rb

@@ -5,6 +5,7 @@ module NoResponse
   module Models
     module Shared
       autoload :Assessment, "no_response/models/shared/assessment.rb"
+      autoload :AssessmentAuthContext, "no_response/models/shared/assessmentauthcontext.rb"
       autoload :AssessmentList, "no_response/models/shared/assessmentlist.rb"
       autoload :AssessmentOutcome, "no_response/models/shared/assessmentoutcome.rb"
       autoload :AssessmentOutcomeRequest, "no_response/models/shared/assessmentoutcomerequest.rb"

data/lib/no_response/sdkconfiguration.rb

@@ -88,13 +88,16 @@ module NoResponse
         @security_source = security_source
       elsif !api_key.nil?
         @security_source = -> { Models::Shared::Security.new(api_key: api_key) }
+      elsif !ENV.fetch("NORESPONSE_API_KEY", "").empty?
+        env_security = Models::Shared::Security.new(api_key: ENV.fetch("NORESPONSE_API_KEY"))
+        @security_source = -> { env_security }
       end
 
       @language = "ruby"
       @openapi_doc_version = "1"
-      @sdk_version = "2.0.19"
+      @sdk_version = "2.1.0"
       @gen_version = "internal"
-      @user_agent = "noresponse-sdk/ruby 2.0.19 internal 1 noresponse"
+      @user_agent = "noresponse-sdk/ruby 2.1.0 internal 1 noresponse"
     end
 
     sig { returns([String, T::Hash[Symbol, String]]) }

data/lib/no_response/webhookendpoints.rb

@@ -706,7 +706,7 @@ module NoResponse
           response: http_response
         )
         return Models::Operations::DeleteWebhookEndpointResponse.new(
-          headers: {}
+          headers: http_response.headers
         )
       elsif Utils.match_status_code(http_response.status, ["400"])
         if Utils.match_content_type(content_type, "application/problem+json")

data/lib/no_response/webhooks.rb

@@ -50,9 +50,13 @@ module NoResponse
     # "assessment.updated", and an EndpointVerification for
     # "endpoint.verification". Deliveries are at least once and unordered:
     # deduplicate on id and keep the highest assessment_version.
-    Event = Struct.new(:id, :type, :created_at, :data, keyword_init: true) do
+    Event = Struct.new(:id, :type, :created_at, :data, :test, keyword_init: true) do
       # True for the terminal expiry event: delete what you hold and fetch nothing.
       def expired? = data.is_a?(AssessmentExpired)
+
+      # True on an event sent by the send-test-event call: data is a fixed
+      # example assessment, not one of yours. Acknowledge it and apply nothing.
+      def test? = test == true
     end
 
     class << self
@@ -132,7 +136,8 @@ module NoResponse
           raise VerificationError.new(:invalid_payload, 'Webhook event envelope is malformed')
         end
 
-        Event.new(id: body['id'], type: body['type'], created_at: body['created_at'], data: event_data(body['type'], data))
+        Event.new(id: body['id'], type: body['type'], created_at: body['created_at'], data: event_data(body['type'], data),
+                  test: body['test'] == true && body['type'] == 'assessment.updated')
       end
 
       def event_data(type, data)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: noresponse
 version: !ruby/object:Gem::Version
-  version: 2.0.19
+  version: 2.1.0
 platform: ruby
 authors:
 - NoResponse
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-22 00:00:00.000000000 Z
+date: 2026-10-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: base64
@@ -326,6 +326,8 @@ files:
 - lib/no_response/models/shared/alternate_name_union.rbi
 - lib/no_response/models/shared/assessment.rb
 - lib/no_response/models/shared/assessment.rbi
+- lib/no_response/models/shared/assessmentauthcontext.rb
+- lib/no_response/models/shared/assessmentauthcontext.rbi
 - lib/no_response/models/shared/assessmentlist.rb
 - lib/no_response/models/shared/assessmentlist.rbi
 - lib/no_response/models/shared/assessmentoutcome.rb